# Privacy Policy

Last updated: May 1, 2025

Crossnode ("us", "we", or "our") operates the Crossnode platform (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. We are committed to complying with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

## 1. Information We Collect

We collect several types of information to provide and improve our Service.

### Types of Data Collected

- **Personal Data:** When you register or use our Service we may ask for your email address, full name, and profile photo. We also store your agency preferences, onboarding answers, and referral information.
- **Usage Data:** We automatically collect information about how you interact with the Service, such as IP address, browser type, pages visited, timestamps, agent run logs, and workflow execution data. This data is used to maintain service quality and detect errors.

## 2. How We Use Your Data

We process your personal data on the following legal bases (GDPR Art. 6):

- Performance of a contract — to create and manage your account, process payments, and deliver the Service you subscribed to.
- Legitimate interests — to monitor system performance, detect fraud, debug errors, and send critical service announcements.
- Consent — to analyse your usage with PostHog and record sessions with Sentry. You can withdraw this consent at any time via our cookie banner or by emailing privacy@crossnode.sh.
- Legal obligation — to retain financial records as required by law.

## 3. Cookies & Analytics

We use two categories of cookies:

### Cookie Categories

- **Necessary (always active):** HttpOnly session cookies used exclusively for authentication and security. These cannot be disabled.
- **Analytics (requires consent):** PostHog for product analytics and Sentry for error monitoring including session replay. These are only initialised after you click "Accept All" on our cookie banner. You may opt out at any time by clicking "Reject Optional" in the banner or by contacting privacy@crossnode.sh.

## 4. Data Retention

We retain personal data only as long as necessary for the purposes set out in this policy:

- Account data — kept for the duration of your account plus 30 days after deletion.
- Run logs & audit logs — retained for 12 months, then purged.
- Payment records — retained for 7 years to comply with financial regulations.
- Analytics events — retained by PostHog for 1 year (EU-hosted option available on request).
- Error reports — retained by Sentry for 90 days.

## 5. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) you have the following rights:

- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — request deletion of your personal data. You can trigger this directly from your account settings or by emailing privacy@crossnode.sh.
- Right to data portability — download all your organisation's data as a ZIP from Settings → Data Export.
- Right to object — object to processing based on legitimate interests, including direct marketing.
- Right to restrict processing — request that we limit how we process your data in certain circumstances.
- Right to withdraw consent — for analytics cookies, withdraw consent at any time via the cookie banner.

To exercise any of these rights, email privacy@crossnode.sh. We will respond within 30 days. If you believe we have not complied with your rights, you have the right to lodge a complaint with your local supervisory authority.

## 6. International Data Transfers

Crossnode uses US-based infrastructure providers (Google Cloud, AWS, Stripe, PostHog). Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection. A full list of our subprocessors is available at crossnode.sh/subprocessors.

## 7. Security

We protect your data using industry-standard measures: TLS encryption in transit, AES-256 encryption at rest, HttpOnly cookies for session tokens, bcrypt password hashing, and multi-factor authentication. Despite these measures, no system is 100% secure, and we cannot guarantee absolute security.

## 8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and/or a prominent notice in the Service at least 14 days before they take effect. The "last updated" date at the top of this page will always reflect the most recent revision.

## 9. Contact Us

For any questions, data requests, or complaints regarding this Privacy Policy, please contact our privacy team at: [privacy@crossnode.sh](mailto:privacy@crossnode.sh)